It's not the same without you

Join the community to find out what other Atlassian users are discussing, debating and creating.

Atlassian Community Hero Image Collage
Highlighted

ssh ciphers issue JIRA and Confluence

Hi ,

We have successfully migrated and upgraded JIRA and Confluence applications to latest versions. JIRA(7.4.1) and Confluence(6.2.4) in DEV Environment.

We have not used a secure connection(https) as we are in DEV environment.

After the applications were successfully upgraded to the latest available versions, we need to have a scan of the application servers by the network team here.

Below is the response from our network team after the security scan of the JIRA and Confluence application servers.

#############################################################

The following ssh ciphers were marked as an issue:
 
  • arcfour
  • arcfour128
  • arcfour256
I have personally never seen these ciphers before and they have never come up on any scans we have done in the past so it could be something that the application setup which needs to be verified because if that is not the case I will need to remove them. If the application did install them than we need a validation of why they are required which will have to be signed off by security.

#############################################################

Thanks,

Nav

2 comments

Hi Nav,

JIRA/Confluence installs don't modify openssh. Those ciphers weren't enabled or modified by Atlassian applications, so you should be able to disable them without adversely affecting your application installs.

I can't advise you specifically on how to disable those ciphers as I don't know what distribution you're running, but it should be easy enough to Google for your distribution + "disable arcfour cipher".

Good luck!

It's not clear what was tested here.  If you're just using JIRA and Confluence on http though, it could not have been them.

For most ssh daemons, look in the sshd_config , found typically in /etc/ssh/ .   You should probably check ssh_config while you're there too.

If it is the JIRA/Confluence you need to check, then you will either need to look at the proxy you have in front of them, or the Tomcat "connector" settings in server.xml

Comment

Log in or Sign up to comment
TAGS

Community Events

Connect with like-minded Atlassian users at free events near you!

Find an event

Connect with like-minded Atlassian users at free events near you!

Unfortunately there are no Community Events near you at the moment.

Host an event

You're one step closer to meeting fellow Atlassian users at your local event. Learn more about Community Events

Events near you